Deploy and update Granola with MDM

Granola releases updates about twice a week, and the desktop app is built to install them itself. On many devices you don’t need to manage updates at all. This guide helps you work out whether your setup needs managed updates, and how to set them up if it does. To configure other app settings with MDM, see Configure Granola with MDM.

How Granola updates itself

While Granola is running, it checks for a new version about every 10 minutes and downloads it in the background. It installs the update when it can restart without getting in anyone’s way: not while someone is recording or transcribing a meeting, and not while they’re actively using the app. This only works if the signed-in person is allowed to replace Granola’s app files, which usually means they installed Granola themselves. Whether they can depends on how Granola was installed:

How Granola is installed	Does it update itself?	What to do
Windows, default installer (installed for each person)	Yes, with no admin rights needed	Nothing. See Windows.
Windows, moved into `C:\Program Files`	No. Each update needs admin approval.	Reinstall it for each person. See Windows.
macOS, installed by the person using it, for example by dragging Granola into Applications	Yes, with no password needed	Nothing.
macOS, installed by IT or another account, used by someone with admin rights	Yes, but macOS asks for their password for each update	Set up managed updates on macOS to remove the prompt.
macOS, installed by IT or another account, used by someone without admin rights	No. macOS asks for an admin password they don’t have, so the update fails.	Set up managed updates on macOS.

Why Granola needs to stay up to date

We regularly release new features, performance improvements, bug fixes and security updates, and we want everyone to get them as soon as possible. We usually release twice a week. If you set up managed updates as described below, these updates won’t disrupt anyone: they install in the background while people aren’t using Granola. We don’t currently support updating on a slower schedule. If Granola falls behind the current release, people are prompted to update:

More than 4 weeks out of date: people see a prompt asking them to update. They can choose Later for now.
More than 6 weeks out of date: Granola can’t be used until it’s updated.

If the people using your devices can’t install updates themselves, they can’t act on these prompts and need you to update Granola for them. So if you turn off Granola’s built-in updater, make sure the managed update script below is running. It’s what keeps Granola current.

Set up managed updates on macOS

Managed updates replace Granola’s built-in updater with a script that your MDM runs as root. Because the script has admin rights, nobody sees a password prompt. You’ll set up three things:

The latest version of Granola, installed by your MDM.
A managed setting, DisableAutoUpdate, that turns off the built-in updater so the two updaters don’t compete.
The Granola update script, run by your MDM every 15 minutes.

What the script does

Each time it runs, the script makes one attempt to update Granola:

It checks for a newer production release of Granola, the same version people get from granola.ai. If Granola is already current, it stops.
If Granola isn’t running, it installs the update straight away.
If Granola is running, it asks Granola whether now is a good time. Granola only agrees when nobody is recording or transcribing, using the Granola camera, or actively using the app. Granola then quits, the update installs, and Granola reopens.
If now isn’t a good time, the script leaves Granola alone and exits. It tries again on its next run.

Running every 15 minutes means updates install soon after release, in a gap between meetings, without interrupting anyone. A less frequent schedule doesn’t make updates less disruptive. It makes them less likely to happen. A once-a-day run during working hours often lands while someone is in a meeting, so the update is skipped until the next day, and possibly the day after. Devices then drift out of date and reach the update prompts.

Step 1: Deploy the latest version of Granola

Before you turn on managed updates, use your MDM to deploy the latest version of Granola to every Mac. Download it from https://api.granola.ai/v1/download-latest. Do this even on Macs that already have Granola. The script can only update Granola 7.466.0 or later, and people who installed Granola a while ago may be on an older version. The script also checks that:

Granola is installed at /Applications/Granola.app, not in another folder or as an alias.
The app is owned by root and standard users can’t change it.

MDM deployments normally meet these requirements. If someone installed Granola themselves by dragging it into Applications, the app belongs to them rather than root, so deploy over it. To check a Mac, run:

stat -f "%Su %Sp" /Applications/Granola.app

The output should look like root drwxr-xr-x.

Step 2: Turn off Granola’s built-in updater

Deploy a configuration profile with this setting:

Preference domain: com.granola.app
Key: DisableAutoUpdate
Type: Boolean
Value: true

Deploy it at the device (computer) level, not to users. The script reads the device-level setting and won’t run without it. If you already deploy a com.granola.app profile, for example to set DisableOAuth, add DisableAutoUpdate to that profile instead of creating a second one. Some MDMs ask for a property list for the preference domain. Use this one:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>DisableAutoUpdate</key>
    <true/>
</dict>
</plist>

Others ask for a complete configuration profile. Save this one as a .mobileconfig file:

granola-managed-updates.mobileconfig

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>PayloadContent</key>
    <array>
        <dict>
            <key>PayloadContent</key>
            <dict>
                <key>com.granola.app</key>
                <dict>
                    <key>Forced</key>
                    <array>
                        <dict>
                            <key>mcx_preference_settings</key>
                            <dict>
                                <key>DisableAutoUpdate</key>
                                <true/>
                            </dict>
                        </dict>
                    </array>
                </dict>
            </dict>
            <key>PayloadDisplayName</key>
            <string>Granola managed preferences</string>
            <key>PayloadIdentifier</key>
            <string>ai.granola.disable-auto-update.managed-preferences</string>
            <key>PayloadType</key>
            <string>com.apple.ManagedClient.preferences</string>
            <key>PayloadUUID</key>
            <string>06ACDD62-6FF1-4882-AF6D-4EBB45452BAD</string>
            <key>PayloadVersion</key>
            <integer>1</integer>
        </dict>
    </array>
    <key>PayloadDescription</key>
    <string>Lets your MDM manage Granola updates.</string>
    <key>PayloadDisplayName</key>
    <string>Granola managed updates</string>
    <key>PayloadIdentifier</key>
    <string>ai.granola.disable-auto-update</string>
    <key>PayloadOrganization</key>
    <string>Granola</string>
    <key>PayloadScope</key>
    <string>System</string>
    <key>PayloadType</key>
    <string>Configuration</string>
    <key>PayloadUUID</key>
    <string>BFAE9C0A-6221-4A80-A4FA-3EB736B0DDB3</string>
    <key>PayloadVersion</key>
    <integer>1</integer>
</dict>
</plist>

Step 3: Add the update script

Add this script to your MDM exactly as it is. It doesn’t take any parameters. It’s a short launcher: it checks that the installed Granola app is genuine, then runs the full updater that ships inside the app.

Granola update script

#!/bin/bash

# Granola managed updater launcher for MDM tools
#
# Recommended deployment:
#   1. Deploy a current Granola build that contains the managed updater.
#   2. Push DisableAutoUpdate=true in the com.granola.app preference domain.
#   3. Run this launcher as root from your MDM every 15 minutes.
#
# The full updater is bundled inside the signed, root-owned Granola app. This
# launcher verifies the app and updater, copies the updater out of the bundle it
# will replace, and executes that verified copy as root.

# Stop on any error, unset variable or failed command in a pipeline.
set -euo pipefail

# Only use system tools, so nothing earlier in PATH can stand in for them.
PATH="/usr/bin:/bin:/usr/sbin:/sbin"

# Where Granola is installed, and the values a genuine Granola app must have.
# QZ7DHHLN25 is Granola's Apple Developer Team ID.
readonly LAUNCHER_VERSION="1"
readonly APP_PATH="/Applications/Granola.app"
readonly APP_BUNDLE_ID="com.granola.app"
readonly EXPECTED_TEAM_ID="QZ7DHHLN25"
readonly LOCK_PATH="/private/var/run/granola-managed-update.lock"
readonly LOCK_UNAVAILABLE_EXIT_CODE=75
readonly UPDATER_PATH="$APP_PATH/Contents/Resources/managed-update/install-granola.sh"

TEMPORARY_UPDATER=""

# Every line this script prints starts with a prefix, so it's easy to find in
# your MDM's logs.
log() {
  printf '[Granola updater launcher] %s\n' "$*"
}

fail() {
  log "ERROR: $*"
  exit 1
}

# Remove the temporary copy of the updater when the script exits, whether it
# succeeded or not.
cleanup() {
  if [ -n "$TEMPORARY_UPDATER" ]; then
    /bin/rm -f "$TEMPORARY_UPDATER"
  fi
}
trap cleanup EXIT

# Check the installed app before trusting anything inside it. It must be a real
# folder in /Applications (not a shortcut), owned by root, and not changeable by
# standard users, so nobody without admin rights could have tampered with it.
[ "$(/usr/bin/id -u)" -eq 0 ] || fail "This launcher must run as root."
[ -d "$APP_PATH" ] && [ ! -L "$APP_PATH" ] ||
  fail "Granola must be installed as a real app bundle in /Applications."
[ "$(/usr/bin/stat -f "%u" "$APP_PATH")" = "0" ] ||
  fail "Granola.app must be owned by root."

app_mode="$(/usr/bin/stat -f "%Lp" "$APP_PATH")"
(( (8#$app_mode & 022) == 0 )) ||
  fail "Granola.app must not be writable by non-root users."

# Check that the app is genuinely Granola: its code signature is intact, it was
# signed by Granola's Apple developer account, and its bundle ID is Granola's.
/usr/bin/codesign --verify --deep --strict "$APP_PATH" >/dev/null 2>&1 ||
  fail "The installed Granola app has an invalid code signature."

team_id="$(
  /usr/bin/codesign -dv --verbose=4 "$APP_PATH" 2>&1 |
    /usr/bin/awk -F= '$1 == "TeamIdentifier" { print $2; exit }'
)"
[ "$team_id" = "$EXPECTED_TEAM_ID" ] ||
  fail "The installed Granola app has an unexpected signing Team ID."

bundle_id="$(
  /usr/libexec/PlistBuddy \
    -c "Print :CFBundleIdentifier" \
    "$APP_PATH/Contents/Info.plist" 2>/dev/null || true
)"
[ "$bundle_id" = "$APP_BUNDLE_ID" ] ||
  fail "The installed Granola app has an unexpected bundle identifier."

# Check the full updater that ships inside the app. Versions of Granola before
# 7.466.0 don't include it. Like the app, it must be owned by root and not
# changeable by standard users.
[ -f "$UPDATER_PATH" ] && [ ! -L "$UPDATER_PATH" ] ||
  fail "The installed Granola app does not contain a managed updater."
[ "$(/usr/bin/stat -f "%u" "$UPDATER_PATH")" = "0" ] ||
  fail "The bundled managed updater must be owned by root."

updater_mode="$(/usr/bin/stat -f "%Lp" "$UPDATER_PATH")"
(( (8#$updater_mode & 022) == 0 )) ||
  fail "The bundled managed updater must not be writable by non-root users."

# The updater replaces the app it lives in, so copy it out first and run the
# copy. The copy goes in a root-only system folder, readable only by root.
umask 077
TEMPORARY_UPDATER="$(
  /usr/bin/mktemp "/private/var/run/granola-managed-updater.XXXXXX"
)"
/bin/cp "$UPDATER_PATH" "$TEMPORARY_UPDATER"
/usr/sbin/chown root:wheel "$TEMPORARY_UPDATER"
/bin/chmod 700 "$TEMPORARY_UPDATER"

# Confirm the copy matches the original exactly, and that the app's signature
# is still intact, so nothing changed while the copy was being made.
source_hash="$(/usr/bin/shasum -a 256 "$UPDATER_PATH" | /usr/bin/awk '{ print $1 }')"
copy_hash="$(/usr/bin/shasum -a 256 "$TEMPORARY_UPDATER" | /usr/bin/awk '{ print $1 }')"
[ "$source_hash" = "$copy_hash" ] ||
  fail "The copied managed updater does not match the signed app resource."

/usr/bin/codesign --verify --deep --strict "$APP_PATH" >/dev/null 2>&1 ||
  fail "Granola changed while its managed updater was being prepared."

# Run the updater. The lock stops two runs overlapping: if a previous run is
# still going, for example a slow download, this run exits straight away.
log "Running launcher version $LAUNCHER_VERSION."
set +e
/usr/bin/lockf -s -t 0 -k "$LOCK_PATH" /bin/bash "$TEMPORARY_UPDATER"
updater_status=$?
set -e

# Another run already in progress isn't a failure, so report success to the MDM.
# Otherwise, pass on the updater's own result.
if [ "$updater_status" -eq "$LOCK_UNAVAILABLE_EXIT_CODE" ]; then
  log "Another managed update is already running."
  exit 0
fi

exit "$updater_status"

Step 4: Set it up in your MDM

Deploy the profile from Step 2, then schedule the script from Step 3 to run as root every 15 minutes on the same Macs. Use only this script to update Granola. If your MDM has an app catalog or patching feature that also updates Granola, turn it off for Granola, because those tools don’t use Granola’s checks for meetings in progress. Don’t add a step that quits Granola, either. The script handles that safely.

Jamf Pro

Profile: In Computers > Configuration Profiles, create a profile with an Application & Custom Settings payload. Choose Upload, set the preference domain to com.granola.app, and upload the property list. Set the profile’s level to Computer Level.Script:

In Settings > Computer Management > Scripts, add the update script.
In Computers > Policies, create a policy and add the script to it.
Set the trigger to Recurring Check-in and the execution frequency to Ongoing.
Scope the policy to the Macs that have the profile.
In Settings > Computer Management > Check-in, set the check-in frequency to Every 15 minutes.

The check-in frequency applies to all policies in your Jamf instance. If yours is set to a longer interval, the Granola policy runs on that schedule instead.

Iru (formerly Kandji)

Profile: Add a Custom Profile Library Item, upload the .mobileconfig file, and assign it to your Blueprints.Script:

Add a Custom Script Library Item and assign it to the same Blueprints.
Set Execution Frequency to Run every 15 min.
Paste the update script into Audit Script. Leave Remediation Script turned off.

Iru always runs custom scripts as root, so there’s nothing else to set.

Microsoft Intune

Profile: In Devices > macOS > Configuration, create a policy from the Preference file template. Set the preference domain name to com.granola.app, upload the property list, and assign the policy to your Macs.Script:

In Devices > macOS > Scripts, add a script and upload the update script as a .sh file.
Set Run script as signed-in user to No, so it runs as root.
Set Script frequency to Every 15 minutes.
Set Hide script notifications on devices to Yes. Otherwise people see an “IT is configuring your computer” notification every 15 minutes.
Assign the script to the same Macs as the profile.

Intune only reports the result of the script’s first run. To check later runs, look at the logs on the Mac. See Confirm managed updates are working.

JumpCloud

Profile: Create a Mac policy from the MDM Custom Configuration Profile template, upload the .mobileconfig file, and apply it to your Macs.Script:

In Device Management > Commands, create a command with the type Mac.
Set Run As to root, and paste the update script into the command field.
Set Event to Run as Repeating, repeating by Minute, every 15.
Set Timeout After to at least 1800 seconds, so a slow download isn’t cut off.
Bind the command to the same Macs as the profile.

Rippling

Profile: In IT > Device Management > Configurations, upload the .mobileconfig file on the macOS tab, then deploy it to your Macs. Upload it from a Mac, because Rippling may not save .mobileconfig uploads from other operating systems.Script: Add the update script as a custom Bash script, choose a Recurring schedule, and target the same Macs. Rippling runs custom scripts as root. Choose a 15-minute interval if it’s offered, or the shortest one available.

Other MDM tools

Managed updates work with any MDM, including Mosyle, Addigy, Omnissa Workspace ONE and FleetDM, as long as it can:

Deploy a device-level configuration profile or managed preference for com.granola.app.
Run a script as root every 15 minutes.
Let the script run for up to 30 minutes, since downloading and installing an update can take a while on a slow connection.

Confirm managed updates are working

Run the script on a test Mac, then check its output in your MDM’s logs. To run it straight away, use sudo jamf policy in Jamf Pro or sudo iru run in Iru. Each line of output starts with [Granola updater launcher] or [Granola updater], and errors start with ERROR:.

Message	What it means
`Granola is already current or newer; no installation is needed.`	Working. There’s nothing to install yet.
`Granola <version> was installed successfully.`	Working. The update installed and Granola reopened.
`Granola deferred the update. MDM can retry on the next policy run.`	Working. Granola was in use, so the script will try again on its next run.
`DisableAutoUpdate must be enabled before MDM manages updates.`	The profile from Step 2 isn’t on this Mac, or it was deployed to users instead of the device.
`The installed Granola app does not contain a managed updater.` or `This Granola version does not support managed update handoff.`	This Mac has a version of Granola older than 7.466.0. Deploy the latest version (Step 1).
`Granola.app must be owned by root.` or `Granola.app must not be writable by non-root users.`	Granola wasn’t installed by your MDM. Deploy the latest version over it (Step 1).
`Granola must be installed as a real app bundle in /Applications.`	Granola is missing or installed in another folder. Deploy it to `/Applications` (Step 1).

Windows

Granola’s Windows installer installs Granola for the person who runs it, in their own AppData\Local\Programs folder. They own those files, so Granola can update itself without admin rights or an approval prompt. You don’t need to manage updates on Windows.

Deploy Granola to Windows PCs

Run the installer as the signed-in person rather than as the system, so Granola is installed into their profile. For example, in Microsoft Intune, add it as a Windows app (Win32) with Install behavior set to User. To install silently, add /S:

Granola-<version>-win-x64.exe /S

Download the latest installer from https://api.granola.ai/v1/download-latest-windows.

If Granola is in C:\Program Files

Granola doesn’t support installing for all users on Windows. If Granola was installed into C:\Program Files, for example by passing a custom install folder, people need admin approval for every update, so Granola falls behind and eventually stops working. Uninstall that copy, then deploy Granola for each person. From then on, Granola keeps itself up to date.

Getting started

Taking notes

Organising and sharing

Granola Chat

Customizing Granola

Managing your account

Subscriptions

Security, Privacy & Transparency

Troubleshooting

Voice typing

How Granola updates itself

Why Granola needs to stay up to date

Set up managed updates on macOS

What the script does

Step 1: Deploy the latest version of Granola

Step 2: Turn off Granola’s built-in updater

Step 3: Add the update script

Step 4: Set it up in your MDM

Confirm managed updates are working

Windows

Deploy Granola to Windows PCs

If Granola is in C:\Program Files

​How Granola updates itself

​Why Granola needs to stay up to date

​Set up managed updates on macOS

​What the script does

​Step 1: Deploy the latest version of Granola

​Step 2: Turn off Granola’s built-in updater

​Step 3: Add the update script

​Step 4: Set it up in your MDM

​Confirm managed updates are working

​Windows

​Deploy Granola to Windows PCs

​If Granola is in C:\Program Files

How Granola updates itself

Why Granola needs to stay up to date

Set up managed updates on macOS

What the script does

Step 1: Deploy the latest version of Granola

Step 2: Turn off Granola’s built-in updater

Step 3: Add the update script

Step 4: Set it up in your MDM

Confirm managed updates are working

Windows

Deploy Granola to Windows PCs

If Granola is in C:\Program Files